15787 matches found
curl: curl 8.23.0 keeps sending requests to an HTTP/3 backend after Alt-Svc: clear
In an owned local test of curl 8.23.0 with HTTP/3 and persistent --alt-svc, an HTTPS origin advertised an H3 alternative; after its operator stopped advertising H3, the trusted edge returned Alt-Svc: clear on the H3 route. Curl retained the HTTP/2-to-HTTP/3 cache entry and sent a later request to...
curl: Re-entrant curl_easy_pause UAF in cw-pause
Summary This report is a bypass of the prior fix for the nested curleasypause re-entrancy issue described in HackerOne report 4102061. The original patch guarded the writer path in lib/cw-out.c by adding a re-entrancy guard around cwoutflushchain, but it did not guard the sibling writer...
WordPress: Unauthenticated Disclosure of Private, Draft, and Password-Protected Post Content via Core Read-Permission Bypass in SCF Reference Fields
A vulnerability was discovered in a WordPress plugin's reference field functionality that allowed unauthenticated users to access non-public post content through a permission bypass. The issue existed in the post retrieval function, which did not enforce read permission checks when retrieving pos...
curl: Incomplete IDN hostname check on the transfer path can lead to credential disclosure to an unintended host
Summary The fix that rejects URL-separator characters introduced by IDN decoding hostnamecheck after hostdecode was applied only to the curlurlget getter path. The transfer path still IDN-decodes the URL host with libidn2 and stores the result without any hostnamecheck. Because libidn2 maps U+FF2...
curl: CURL_NETRC_REQUIRED sends the URL password when the .netrc file has no matching entry
Summary In required netrc mode CURLNETRCREQUIRED, as set by --netrc or --netrc-file, the CURLOPTNETRC documentation says any credential information present in the URL is ignored, but when the configured .netrc file loads successfully yet has no entry matching the requested host and username,...
curl: CVE-2026-115529: Schannel TLS auto client session resumption
Summary: In curl 8.23.0 with Schannel, TLS session resumption preserves an authenticated client certificate identity across a cross-origin redirect even after automatic client certificate selection is disabled. This appears to be an incomplete fix for CVE-2026-86415, where the original fix...
curl: --cert-status with OpenSSL accepts a stapled OCSP response of any age when it lacks nextUpdate (revoked certificate keeps passing)
Summary: curl built with OpenSSL accepts a stapled OCSP "good" response of any age under CURLOPTSSLVERIFYSTATUS --cert-status when the response omits nextUpdate, so a response signed before a certificate was revoked keeps passing the check for as long as the certificate itself is valid. The GnuTL...
curl: Heap-use-after-free in libcurl's multi event machinery (curl_multi_remove_handle() from a socket callback nested under a notify callback)
Summary: The multi interface in libcurl 8.23.0 and current master has a reproducible use-after-free. Inside a CURLMOPTNOTIFYFUNCTION callback, calling curleasypause on a second transfer that is still in flight re-enters libcurl's event handling and invokes the socket callback, where a...
curl: IDN decoding inserts authority delimiters and can redirect proxy CONNECT to a different host
IDN decoding can insert authority delimiters: CURLUPUNYCODE output does not round-trip and proxy requests carry an ambiguous authority Summary libcurl's IDN decoder accepts a hostname containing U+FF20 FULLWIDTH COMMERCIAL AT ＠. libidn2's TR46 transitional fallback converts it to ASCII @...
curl: POP3: data after the end-of-body terminator is written into the retrieved message
Vulnerability Information When a POP3 server sends the end-of-body terminator and further data in the same read, curl writes the bytes after the terminator into the retrieved message's output file and still reports success. The PoC returns the message, its "." line, and then a second "+OK" respon...
curl: A server response that answers nothing is used as the next transfer's reply — and with IMAP, a fully compliant server does this by accident
Name: Maturi Jaswanth Sai Madhu Mohan Product: curl / libcurl — all four pingpong protocols demonstrated: IMAP, POP3, SMTP and FTP — the same protocol set curl's own CVE-2026-92387 names Affected: reproduced on current git master dbb8262a9c 8.23.1-DEV, fetched and rebuilt today, on d1d4b5931a, on...
curl: server filename with control characters printed to terminal (`-J`)
Summary: With -OJ, curl takes the filename from the server's Content-Disposition header. parsefilename in src/toolcbhdr.c does not remove control characters such as ESC 0x1b. When a warning prints that name, the escape sequences reach the terminal. Steps to reproduce 1. Build curl from the source...
curl: HSTS cache file: three trailing dots silently disable HSTS for that host
Researcher: Maturi Jaswanth Sai Program: curl HackerOne Asset: github.com/curl/curl, lib/hsts.c Affected: curl 8.20.0, 8.21.0, 8.22.0 and 8.23.0 tag curl-8230, 2026-10-14, plus master eb2b201a 8.23.1-DEV, 2026-10-19 Weakness: CWE-295 / CWE-693, an HSTS pin that silently stops applying Before we...
curl: TLS session cache ignores CURLOPT_SSL_CTX_FUNCTION identity and resumes one client's session for another
Researcher: Maturi Jaswanth Sai Program: curl HackerOne Asset: github.com/curl/curl, lib/vtls/vtlsscache.c Affected: curl 8.21.0, 8.22.0 and 8.23.0 tag curl-8230, 2026-10-14, plus master eb2b201a 8.23.1-DEV, 2026-10-19 Weakness: CWE-295, wrong client identity on a resumed TLS session. Same class ...
curl: curl reuses an HTTPS connection when a response is already buffered in the TLS stack
curl master 15292ed75, 8.23.1-DEV reuses an idle HTTP/1.1-over-TLS connection even when a complete extra response is already buffered in OpenSSL/GnuTLS. The ef6b17cf1 fix only polls the socket: Curlcpoolconnseemshealthy lib/conncache.c:1073, called from lib/url.c:1071 uses Curlconnisalive, and...
curl: Pinned public key check passes for a key the server does not hold with the wolfSSL backend
Summary: With the wolfSSL backend, --pinnedpubkey is checked against a public key that curl extracts by re-parsing the server certificate with its own ASN.1 parser lib/vtls/x509asn1.c, while wolfSSL verifies the chain with its own parser. curl 8.23.0 added a check that the validity field of the...
curl: CVE-2026-115528: wolfSSL TLS connect without cert
A vulnerability was discovered in curl when built with wolfSSL that allowed TLS connections to complete without certificate verification. When using default certificate verification settings, curl accepted anonymous Diffie-Hellman cipher suites that transmitted no server certificate. This caused...
curl: urlapi: CURLUPART_HOST accepts text after an IPv6 zone ip and URL round trip changes the host
Summary: six or fewer sentences describing the issue in your own human voice and optionally a short proof-of-concept script An app can set a host from untrusted input from CURLUPARTHOST, as the docs allow, and rely on curl to reject bad hosts. curl accepts fe80::1%[email protected]/x as a valid...
curl: wolfSSL Backend Silently Ignores --cert-status (OCSP Stapling Bypass)
Summary When curl is built with the wolfSSL TLS backend, --cert-status CURLOPTSSLVERIFYSTATUS is silently accepted and ignored. The wolfSSL backend sets certstatusrequest = NULL in its vtable lib/vtls/wolfssl.c:2309, meaning OCSP stapling is not implemented. The curleasysetopt call returns...
curl: Derived cookie Path aborts cookie jar loading in curl 8.23.0
Hello curl security team, I am reporting a related cookie-jar failure that I reproduced on the official curl 8.23.0 release. Summary A server redirects curl to a path approximately 5 KB long and responds there with a short cookie that has no Path attribute. curl derives the cookie path from the...
curl: SSH host-key policy is missing from the connection-reuse tuple: strict pins and knownhosts are silently skipped on reused SFTP/SCP connections
The core effect is a silent host-authentication bypass: a transfer whose configured SSH host-key policy would reject the server is served anyway, with exit code 0 and no warning, because it reuses a pooled connection established under a weaker or absent policy. curl may assess this lower because ...
curl: OpenSSL `--cert-status` accepts indefinitely stale GOOD OCSP staples
Summary When curl uses its OpenSSL backend with CURLOPTSSLVERIFYSTATUS the --cert-status tool option, a correctly signed OCSP response can be accepted forever if its optional nextUpdate field is absent. curl passes -1 as OpenSSL's maximum permitted age for thisUpdate, explicitly disabling the onl...
curl: Symlink-following truncation of arbitrary files in `Curl_fopen()` when saving cookie jars, HSTS, or alt-svc caches
Affected Component - lib/curlfopen.c, Curlfopen, line 98: curlxfopenfilename, FOPENWRITETEXT - Callers: lib/cookie.c:1543 cookie jar save, lib/hsts.c:390 HSTS save, lib/altsvc.c:415 alt-svc save - CLI entry points: -c / --cookie-jar src/config2setopts.c:575, --hsts FILE :714, --alt-svc FILE :711...
curl: curl EXPIRE_SHUTDOWN timer never armed for silent servers: connection-shutdown timeout bypass in cshutdn (event-driven mode)
Summary curl's non-blocking connection shutdown machinery lib/cshutdn.c is supposed to enforce a 2-second shutdown timeout DEFAULTSHUTDOWNTIMEOUTMS on connections whose peer never answers the graceful shutdown. In curlmultisocketaction event-driven mode the machinery deadlocks: the only code that...
curl: netrc credentials leaked to a cross-host redirect target on the Basic auth path (not covered by redirect credential protections)
Summary curl's redirect credential-leak protection the CURLOPTUNRESTRICTEDAUTH off-by-default guarantee, enforced by Curlauthallowedtoorigin covers three credential sources: a custom Authorization header, CURLOPTUSERNAME/CURLOPTPASSWORD, and cookies. It does not cover credentials read from a .net...
curl: CVE-2026-111951: curl -OJ truncate without filename
In curl versions 8.23.0, 8.22.0, and master branch, a vulnerability was identified in the tool's handling of Content-Disposition headers with the -OJ flag. When a response contained multiple Content-Disposition headers where the first lacked a filename parameter, the tool would create and truncat...
curl: WebSocket send queue use-after-free during nested curl_ws_send()
At lib/ws.c:1734, wsflush borrows a pointer from the outgoing sendbuf and passes it to wssendrawblocking; it skips those bytes only after the send returns. A curlwssend from the WebSocket write callback can be interrupted by a TCP-trace debug callback that calls curlwssend again, and the nested...
curl: SSH (SCP/SFTP) host-key verification is skipped on connection reuse — a pinned/known_hosts transfer silently reuses a previously-unverified connection
Summary For SCP/SFTP, curl verifies the server's host key once, during the initial connect state machine, in sshcheckfingerprint — which reads CURLOPTSSHHOSTPUBLICKEYSHA256 / MD5, the CURLOPTSSHKNOWNHOSTS file, and the CURLOPTSSHHOSTKEYFUNCTION callback. That function has exactly one caller,...
curl: CURLOPT_PROXYHEADER is not part of the HTTP-proxy connection reuse key: a second CONNECT-tunnel transfer silently reuses the first tunnel's Proxy-Auth
Summary When libcurl tunnels through an HTTP proxy with CONNECT HTTPS-over-proxy, the custom headers set via CURLOPTPROXYHEADER are sent to the proxy once, at tunnel-setup time lib/httpproxy.c:63-83. The connection-reuse decision for a proxied connection, however, does not take proxyheaders into...
curl: RTSP ANNOUNCE/SET_PARAMETER upload with --use-ascii / CURLOPT_TRANSFERTEXT sends more body bytes than the declared Content-Length (incomplete fix of e
Summary curl refuses RTSP uploads that combine a body with --crlf / CURLOPTCRLF, because the LF→CRLF conversion makes the number of bytes actually sent differ from the Content-Length curl declares to the server. That guard was added as a security fix: - RTSP: commit e84f95a "rtsp: refuse doing...
curl: GnuTLS + Apple SecTrust discards authenticated OCSP failure
Summary curl 8.23.0 and current master can accept a TLS certificate despite an explicit CURLOPTSSLVERIFYSTATUS=1 / --cert-status requirement when curl uses the GnuTLS backend together with Apple SecTrust. GnuTLS correctly marks an invalid or revoked stapled OCSP response as invalid. Because a...
curl: WebSocket decoder use-after-free when curl_easy_pause() unpauses from a debug callback
Summary At lib/ws.c:503, wsdecpasspayload holds a pointer into the WebSocket receive queue while passing a frame to the application's write callback. If that callback returns CURLWRITEFUNCPAUSE, the PAUSE requested trace invokes the debug callback before the WebSocket pass consumes those bytes...
curl: SCP upload with --crlf sends more bytes than the size declared to the server (same class curl refused for IMAP CVE-2026-87864 and RTSP)
Summary curl recently started REFUSING uploads that combine a size-declaring protocol with CRLF conversion, because the LF-CRLF expansion makes the number of bytes actually sent differ from the size declared to the server: - IMAP APPEND — CVE-2026-87864, lib/imap.c:885-886: ifdata-set.crlf...
curl: TLS session cache key omits native_ca_store: a session validated with CURLSSLOPT_NATIVE_CA can be resumed by a transfer that disabled it (incomplete f
Summary CVE-2026-11564 fixed the connection pool so that a connection whose certificate was validated with the native CA store is not reused by a later transfer that switched to custom CA material. That same field, nativecastore, is compared for connection reuse but is NOT part of the TLS session...
curl: Redirect to imap/pop3/smtp (SASL) or sftp/scp (libssh) authenticates to the attacker's host with the user's ambient Kerberos credentials
Summary: When curl follows a redirect to an IMAP, POP3 or SMTP URL carrying any userinfo imap://@attacker.example/ is enough, it authenticates to the redirect target with SASL GSSAPI out of the user's default Kerberos credential cache, although no credentials and no authentication method were...
curl: Cross-protocol redirect to imap:// or smtp:// uploads the -F/MIMEPOST form and the custom Authorization/Cookie headers to the redirect target
Summary: When a transfer that posts a multipart form CURLOPTMIMEPOST, the tool's -F follows a redirect to an imap:// URL, curl APPENDs the whole form to the mailbox on the redirect target and puts the application's CURLOPTHTTPHEADER list into the mail headers, including custom Authorization: and...
curl: OpenSSL+Apple SecTrust: SecTrust accepts certificates that the app's CURLOPT_SSL_CTX_FUNCTION trust store or verify callback rejected
Summary: On OpenSSL builds with Apple SecTrust USEAPPLESECTRUST, for example Homebrew's curl, libcurl runs the handshake with SSLVERIFYNONE, calls the application's CURLOPTSSLCTXFUNCTION before it, and, if OpenSSL's verification fails, asks Apple SecTrust and accepts the server when SecTrust trus...
curl: CVE-2026-111954: upload reader failed redirect UAF
Summary: Curlreqhardreset lib/request.c line 124 in curl-8230 calls Curlclientreset while req-rewindread may still be set, which keeps the client reader stack for a rewind lib/sendf.c line 82, and only clears the flag at line 157, so the kept stack is never rewound or freed and is still installed...
curl: CVE-2026-11586 fix is incomplete: auto-PONG memory grows without limit through curl_ws_recv() (CONNECT_ONLY)
Summary: The CVE-2026-11586 fix 849317ff5c, "ws: make pong sending lazy" adds the automatic PONG only when the WebSocket send buffer has room, but it put that check in wsflush lib/ws.c:1712. curlwsrecv, the receive call of the documented CONNECTONLY model, still calls wsencaddpending without it a...
curl: passive FTPS data connection handshake blocks curl_multi_perform() with no timeout (regression in 8.19.0)
Summary: On a passive FTPS transfer libcurl runs the TLS handshake of the data connection inside a blocking Curlconnconnect call after the server's 150 lib/ftp.c line 550 in curl-8230, ftpinitiatetransfer, and that blocking loop lib/connect.c line 334 bounds itself with Curltimeleftmsdata, which...
curl: CVE-2026-111953: GnuTLS SecTrust OCSP staple bypass
Summary: When curl is built with GnuTLS and Apple SecTrust, as MacPorts does for curl +gnutls +sectrust, a failed GnuTLS verification is handed to SecTrust, and if SecTrust accepts the chain the GnuTLS result is dropped lib/vtls/gtls.c:1511-1521 in 8.23.0. SecTrust is called without the stapled...
curl: CVE-2026-111952: OpenSSL provider use-after-free again
Summary Since 8.23.0, libcurl caches its OpenSSL certificate store per multi handle even when CURLOPTCAPATH is set. OpenSSL loads CApath certificates lazily during verification, and they belong to the library context of the transfer that loaded them. With CURLOPTSSLENGINE that is a private...
curl: wolfSSL TLS sessions retain native-CA trust after the application narrows trust
Summary In curl 8.23.0 with the wolfSSL backend, a TLS session authenticated while the build-default native CA store is active can be resumed after the application changes the same easy handle to a policy that disables native trust. The second transfer succeeds and exchanges HTTP data even though...
curl: CVE-2026-111950: TLS session cache diff scheme reuse
Summary curl 8.12.0 through 8.23.0 can reuse a TLS session created for an FTPS connection when opening an HTTPS connection to the same hostname and port. The TLS session-cache key contains the hostname, port, transport, TLS backend, and TLS configuration, but it does not contain the URL scheme or...
curl: libcurl shared-HSTS-cache race leads to use-after-free with attacker-controlled function-pointer call
Missing lock on the shared HSTS cache in lib/hsts.c CURLLOCKDATAHSTS allows a race that frees an stsentry still referenced by another thread — deterministic same-address reclaim proves the freed object is fully attacker-writable and its destructor pointer is called with an attacker-chosen argumen...
curl: CRLF injection in the HTTP request-line via `CURLOPT_REQUEST_TARGET` (`--request-target`)
Summary The CURLOPTREQUESTTARGET option string reaches the wire with no CR/LF neutralization, even though it is formatted directly into the HTTP request-line, which is terminated by CRLF. Curlsetstropt lib/setopt.c stores the option string after checking only the 8 MB length cap CURLMAXINPUTLENGT...
curl: curl RTSP connection reuse routes response headers to the RTP callback (rtsp_conn state machine not reset between sessions)
Summary libcurl's RTSP client keeps a per-connection RTP parsing state machine in struct rtspconn state, inheader, rtplen, buf. This state machine is initialised exactly once, when a brand-new connection is allocated, and is never reset thereafter. RTSP connections are pooled and reused across...
curl: CRLF injection in the RTSP request-line and Transport header via `CURLOPT_RTSP_STREAM_URI` and `CURLOPT_RTSP_TRANSPORT`
Summary Two RTSP option strings reach the wire with no CR/LF neutralization, even though each is formatted directly into an RTSP request-line or header field that is terminated by CRLF. Curlsetstropt lib/setopt.c stores each option string after checking only the 8 MB length cap CURLMAXINPUTLENGTH...
curl: curl CONNECT response header colon-check bypass in cf-h1-proxy single_header — proxy authentication bypass via injected HTTP/1.x status line
Summary In the HTTP/1.1 proxy-CONNECT response parser lib/cf-h1-proxy.c, singleheader, the per-line counter data-req.headerline a.k.a. k-headerline is never incremented — only the tunnel-local ts-headerlines is. Curlreqsoftreset resets k-headerline to 0 before the CONNECT exchange begins, and it...
curl: OpenSSL provider OSSL_LIB_CTX used after free via the connection shutdown list (CVE-2026-80229 fix incomplete)
Summary: The CVE-2026-80229 fix 7ea37abc6a, 8.22.0 only marks provider connections connclose, but a closed TLS connection is handed to the multi handle's shutdown list lib/conncache.c:242 and outlives its easy handle, while curleasycleanup frees the handle's OSSLLIBCTX osslprovidercleanup,...